Registry Backup Beta

[neroilo]

If VSS service results corrupted, could this program use registry APIs in place of VSS?
I wouldn't like to use also ERUNT expressly for that.

[Shane]

Using the API's is limited. But I thought about having it as a fall back. The problem is it is dog slow. Even though I have the same API's as erunt.

I am thinking about adding it as a fall back option in future updates

Shane

[Ztruker]

Finally got time to install 1.0. Looks real good. Tutorials (videos) are great.

I've disabled ERUNT and am using this full time now.

[Shane]

Finally got time to install 1.0. Looks real good. Tutorials (videos) are great.

I've disabled ERUNT and am using this full time now.

Woot!

I am working on a small update to the program for this Sunday, nothing big.

I ran my backup on an 2003 server (Not an R2 server) and the api to pull the Windows folder doesn't work! So none of the system reg files show up in the treeview only the user profiles. Yet works fine on 2003 R2.

So I am going to make a small update to add all the system variables the program pulls and add it to the log files. This will help if something isn't being pulled right I can see what.

Shane

[Shane]

Ah found the bug. In my test 2003 machine it works fine.

The 2 others I was on today at a customers has terminal services installed. This changes the api

Terminal Services:   If the application is running in a Terminal Services environment, each user has a private Windows directory. There is also a shared Windows directory for the system. If the application is Terminal-Services-aware (has the IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE flag set in the image header), this function returns the path of the system Windows directory, just as the GetSystemWindowsDirectory function does. Otherwise, it retrieves the path of the private Windows directory for the user.

So I will be adding the TERMINAL_SERVER_AWARE in the next update

Shane

[Shane]

Great, it works

This Sunday I will be putting updates out for every program on the site so they are all TERMINAL_SERVER_AWARE

Shane

[peterr]

Finally got time to install 1.0. Looks real good. Tutorials (videos) are great.

I've disabled ERUNT and am using this full time now.

>>I was going to install next week anyway but this confrirms it.

[Shane]

Wondering if you guys might be up for some more testing in the next week or so?

I am going to add a fall back feature to the program.

If VSS fails it will backup the registry with the Windows API like erunt.

While it will have its limits at least it can still get the core system registry files and the current loaded user. Wont be perfect as it wont be able to grab all the profiles but it will still get the ones erunt does

And since I will have to make some changes to the program I will need this tested.

Thought?

Shane

[peterr]

I'm off with grandchildren S-W. After that  I'll help anytime but remember, I am really not techy; I think that is obvious.
For what you have done, just ask and we will be glad to assist the best we can.
Peter

[neroilo]

No problem here. I have a Windows XP virtual machine ready for any kind of test.

[Shane]

v1.1.0 will be out Sunday.

I am working on 1.2.0 now with the new fall back feature and when I have it done I will post here to have you guys help test

Also adding a new feature to 1.2.0

The fall back option will be under advanced settings. I am also adding the option to let a user tell the program which vss exe to use. The program pulls the OS info with WMI. if WMI isnt working it wont know which vss exe to run. If this happens a user can set it manually

Shane

[chris635]

Sounds good bud


Chris

[Ztruker]

How do we test it? I don't know how to make VSS fail off hand.

Hmmm, I suppose I could simply set VSS to disabled.

Ready and willing 

[Shane]

Disabling it would be the simplest way.

I already have the code done for the reg api backup.

Draw backs are it can only backup the current user profile and the system core reg files but no other profiles. (Same as erunt)

I definitely like the VSS way since it gets them all, a true reg backup since every reg file on the system gets backed up. But at least this way having a fall back it is still helpful for users who have a bad VSS on their system.

This has gone faster than I thought and hope to have a test ready very soon. Biggest pain in the but is changing all the logging around and the wording to handle when it does the fall back.

Shane

[Shane]

ok here we go v1.2.0 Beta

v1.1.0 goes out tomorrow on the site, this build has all those changes, so you get it a day early and help me test 1.2.0.

I made 1.2.0 just today and did some rough tests. I want to have it tested this whole next week and hopfully put it out a week from now for that Sunday release.

Lets see what you guys think

Here is the change log for both 1.1.0 and 1.2.0

v1.2.0
Program now has an advanced settings section.
Program now has a fallback backup method if the volume shadow copy service fails on a system. It will use the Windows API to backup the core registry files and only the current user registry file. Volume shadow copy is the best way to get all registry files on the system, but now with the fallback method, people who don't have a working volume shadow copy are not left out.
Added new setting to control what VSS exe the program uses. The program uses WMI to pull the OS information. but if WMI isn't working correctly the information isn't pulled and the program doesn't know which vss exe to use. With this new setting you can control it if you have any trouble.
Code and log improvements.

v1.1.0
The program is now Terminal Server Aware. When you ran the program on a Windows server that had Terminal Services installed the Windows API returned the wrong path to the windows dir. This is now fixed.
Added more info to the log files showing what system variables the program pulled from the system.
Changed the way the program is complied, the program exe is now smaller.

Shane

[Ztruker]

What do I do with the contents of the zip file for 1.2.0? Can I just run from there once expanded or do I need to replace the currently install one in C:\Program Files (x86)\Tweaking.com\Registry Backup?

There does not appear to be an installer in the zip.

[Shane]

Its just the whole program, same that comes in the installer and the portable. Just extract it to a folder and run it form there or replace the one you have installed with it

Shane

[Tomas_Sweden]

With 1.2.0 I have an extra registry entry under "User Registry Files"
"C:\Users\Default user\ntuser.dat. that I didn't have in 1.0.0.

I noticed that if I check "Enable Fallback Backup Method" I have to restart the program for it to work!
If I start "Registry Backup" with "Enalbe Fallback Backup Method" checked and I uncheck it and try to do a backup it fail, it says: Volum Shadow Copy Failed! vss_start.exe isn't running. vss_start.exe is needed to start the volume snapshot process (even though my Volume Shadow Copy is set to manual and is working).
If I now restart "Registry Backup" and click on "Backup Now" everything works!

Is it possible to have an "apply" button for changes to take effect or maybe write that the user have to restart the program for changes to take effect?

At first I thought that "Enable Fallback Backup Method" worked so that if the "Volume Shadow Copy" wasn't working that "Registry Backup" automatically used the "Windows API" to make a copy, but that is not how it is. I have to manually start the "Windows API" by check "Enable Fallback Backup Method"(and restart the program).
What is the disadvantage of allowing "Registry Backup" automatically detect if the "Volume Shadow Copy" isn't working and it makes a backup with the "Windows API"?

I have tried "Enable Fallback Backup Method" and the program backup only one "User Registry Files" instead of eight so yes there is a difference.

One thing I've noticed now is that if I have many copies under "Select Backup To Restore" under the tab "Restore Registry" and click on the "arrow down" button it is a little bit inflexible to scroll down because there is only room for 8 lines. I would like to have many more "lines" so it's get easier to navigate up and down maybe as long as the program or 20 lines or something like that.
Is it possible if there are more than eight lines that it will automatically get the same height, say up to 20 lines when it will be a scrollbar?

Interesting changes to the program 

Tomas

[neroilo]

Is it possible to have an "apply" button for changes to take effect or maybe write that the user have to restart the program for changes to take effect?

I don't agree so much with it. If it were possible, I'd prefer an immediate activation when you check fallback option.

Other things to fix:
1) Program window is not resizable.
2) A few AV software detect vss_start.exe, vss_pause.exe, TweakingRegistryBackup.exe as dangerous:
https://www.virustotal.com/file/1e61c76d7e04e7a98d50fdf1f1645bf6f2c9b1c94b4b2b24ecc0a71e0f257309/analysis/1339318357/
https://www.virustotal.com/file/3ae8c974c40fdf7e4e08a432792047e80d82e2c86ec59270c2c95c4560263472/analysis/1339318542/
https://www.virustotal.com/file/a541fd17bc4b6f47d3402e5589a8f662029ae7be3ca607b5fb5d88f93386c782/analysis/1339321482/

You could try to report a false positive following these links:
http://analysis.avira.com/samples/index.php
http://cgi.clamav.net/sendfp.cgi
http://community.trendmicro.com/t5/Business-Security-Forum/Submitting-False-positives-by-Trend-Micro/td-p/69282

3) If you try to run a backup (it doesn't matter if you're using VSS or not) on a Windows XP SP3 virtual machine, it will crash the entire VM (at least with Virtualbox).

[Shane]

With 1.2.0 I have an extra registry entry under "User Registry Files"
"C:\Users\Default user\ntuser.dat. that I didn't have in 1.0.0.

Odd you should have. But in this new version I have the program call the backup privilege. This is required with the API to backup the registry. This also allows the program to see lock files such as protected profiles. But the file copy api I use doesnt honor the back privilege. So it fails on those! MS for some reason dont let them honor the backup. Perhaps I have to write my own file copy instead of using the windows api. I will look into that. If I get it to work I can have the program back up locked profiles without having to run it under the system account.

I noticed that if I check "Enable Fallback Backup Method" I have to restart the program for it to work!
If I start "Registry Backup" with "Enalbe Fallback Backup Method" checked and I uncheck it and try to do a backup it fail, it says: Volum Shadow Copy Failed! vss_start.exe isn't running. vss_start.exe is needed to start the volume snapshot process (even though my Volume Shadow Copy is set to manual and is working).
If I now restart "Registry Backup" and click on "Backup Now" everything works!

Ah I have the button stay disabled when it fails, I will fix it so it doesnt stay disabled. This way you dont have to restart the program.

Is it possible to have an "apply" button for changes to take effect or maybe write that the user have to restart the program for changes to take effect?

There wont be a need for it

At first I thought that "Enable Fallback Backup Method" worked so that if the "Volume Shadow Copy" wasn't working that "Registry Backup" automatically used the "Windows API" to make a copy, but that is not how it is. I have to manually start the "Windows API" by check "Enable Fallback Backup Method"(and restart the program).
What is the disadvantage of allowing "Registry Backup" automatically detect if the "Volume Shadow Copy" isn't working and it makes a backup with the "Windows API"?

At first I had it enabled by default but I decided not to. My goal is that the API is very limited and I want the user to know VSS failed and to try to fix it, if they cant they can use the fallback method.

Perhaps it should be enabled by default?

One thing I've noticed now is that if I have many copies under "Select Backup To Restore" under the tab "Restore Registry" and click on the "arrow down" button it is a little bit inflexible to scroll down because there is only room for 8 lines. I would like to have many more "lines" so it's get easier to navigate up and down maybe as long as the program or 20 lines or something like that.
Is it possible if there are more than eight lines that it will automatically get the same height, say up to 20 lines when it will be a scrollbar?

I will see what I can do

1) Program window is not resizable.

I dont think it really needs it as everything fits. But if needed I can add it down the road.

2) A few AV software detect vss_start.exe, vss_pause.exe, TweakingRegistryBackup.exe as dangerous:

I already submitted to antivir but they havent updated it yet.

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC01173358.

A listing of files alongside their results can be found below:

File ID   Filename   Size (Byte)   Result
26930875   vss_start.exe   88 KB   FALSE POSITIVE

Please find a detailed report concerning each individual sample below:

Filename   Result
vss_start.exe   FALSE POSITIVE

The file 'vss_start.exe' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm.

Alternatively you can see the analysis result here:
http://analysis.avira.com/samples/details.php?uniqueid=mCBm5yHWszt97BbEFJ409JHjCy7SRWJW&incidentid=1173358

But thanks for the links to the others, when 1.2.0 is done I will submit the files to them.

3) If you try to run a backup (it doesn't matter if you're using VSS or not) on a Windows XP SP3 virtual machine, it will crash the entire VM (at least with Virtualbox).

Thats odd, I test in vmware and on real systems never had a crash. Maybe the VB6 sp6 runtimes needs to be updated on your test machine?

Shane

[Shane]

Ok new build for v1.2.0

The program can now backup locked profile registry files without having to be ran under the system account 

I changed the wording on the schedule now because of it. And I will have to remake the video when this version comes out lol

Shane

[Tomas_Sweden]

With the new 1.2.0 build I now have two registry entries under "User Registry Files" with the API backup instead of one.

At first I had it enabled by default but I decided not to. My goal is that the API is very limited and I want the user to know VSS failed and to try to fix it, if they cant they can use the fallback method.

Perhaps it should be enabled by default?

I think it's good like the way you have it now, but maybe in future versions that you can change it to "enabled by default" if you get feedback that several users have problem with vss and think they have made an backup with "Task Scheduler", then they have something to fall back on with the API

The program can now backup locked profile registry files without having to be ran under the system account 

What is the reason why I and possibly others have "locked profiles registry files"?

If I "disable" and stop the vss in services and try to do a backup it fails and if I change vss to "manual" and try to do a backup it fails again, even if I start vss it doesn't start.
It says "Volume Shadow Copy Failed! vss_7_64.exe isn't running."
Then I look in process explorer I see that "vss_start.exe" is there and "cmd.exe". If I kill "vss_start.exe"(the file is under TweakingRegistryBackup.exe) and try to do a backup again, it fails. Seems that cmd.exe(this file stands alone, is not under TweakingRegistryBackup.exe) starts then I kill vss_start.exe
If I just restart Registry Backup it works of course! lol   

Have you seen this program "RegBak 1.2"http://www.acelogix.com/freeware.html it seems to be like ERUNT, it backups 6 registry entries then I tried it. Only 1 registry entry in "User Registry Files" 

Tomas

[neroilo]

Have you seen this program "RegBak 1.2"http://www.acelogix.com/freeware.html it seems to be like ERUNT, it backups 6 registry entries then I tried it. Only 1 registry entry in "User Registry Files" 

I use Regback with Windows 7 x64, and in my backup folder I have an "Users" Folder containing 3 ntusers.dat files of different size and 1 UsrClass.dat file.

[DATA5]
Type=USERS\S-1-5-20
Saved=Users\1\NTUSER.DAT
Hive=C:\Windows\SERVIC~2\NETWOR~1\NTUSER.DAT
Category=4
[DATA6]
Type=USERS\S-1-5-19
Saved=Users\2\NTUSER.DAT
Hive=C:\Windows\SERVIC~2\LOCALS~1\NTUSER.DAT
Category=4
[DATA7]
Type=USERS\S-1-5-21-4195982347-1696745222-3389160519-1000
Saved=Users\3\NTUSER.DAT
Hive=C:\Users\neroilo\NTUSER.DAT
Category=2
[DATA8]
Type=USERS\S-1-5-21-4195982347-1696745222-3389160519-1000_Classes
Saved=Users\4\UsrClass.dat
Hive=C:\Users\neroilo\AppData\Local\MICROS~1\Windows\UsrClass.dat
Category=2
[Files]
0=SYSTEM
1=SOFTWARE
2=DEFAULT
3=SECURITY
4=SAM
5=Users\1\NTUSER.DAT
6=Users\2\NTUSER.DAT
7=Users\3\NTUSER.DAT
8=Users\4\UsrClass.dat

[Shane]

I think it's good like the way you have it now, but maybe in future versions that you can change it to "enabled by default" if you get feedback that several users have problem with vss and think they have made an backup with "Task Scheduler", then they have something to fall back on with the API

Good point, I will change it to enabled by default. Better for the normal user who wont know there is a fall back option. This way if VSS fails they wont think my program sucks instead LOL

What is the reason why I and possibly others have "locked profiles registry files"?

When you have more than one account on a system you can choose to protect it, which means no other accounts can access the profile data, which is where that profile registry file is located. My program call the backup privilege in windows and the new file copy method I use gets access to that locked file, so now it can get them as well.

If I "disable" and stop the vss in services and try to do a backup it fails and if I change vss to "manual" and try to do a backup it fails again, even if I start vss it doesn't start.
It says "Volume Shadow Copy Failed! vss_7_64.exe isn't running."
Then I look in process explorer I see that "vss_start.exe" is there and "cmd.exe". If I kill "vss_start.exe"(the file is under TweakingRegistryBackup.exe) and try to do a backup again, it fails. Seems that cmd.exe(this file stands alone, is not under TweakingRegistryBackup.exe) starts then I kill vss_start.exe
If I just restart Registry Backup it works of course! lol   

Old way was to leave the backup button disabled if it failed. The vss_start.exe doesn't close till the program closes. SO if it fails and you fix VSS you need to restart the backup program, shouldn't be a big deal in normal circumstances.

Have you seen this program "RegBak 1.2"http://www.acelogix.com/freeware.html it seems to be like ERUNT, it backups 6 registry entries then I tried it. Only 1 registry entry in "User Registry Files"

and

I use Regback with Windows 7 x64, and in my backup folder I have an "Users" Folder containing 3 ntusers.dat files of different size and 1 UsrClass.dat file.

The extra 2 that it grabs is the network service and local service.

No reason I can have mine grab those with the API, I will add them as well.

Shane

[Shane]

New build.

Fall back is enabled by default for new installs. And the program now grabs the local service and network service reg files on the fall back method as well. So now gets everything Erunt and the RegBak 1.2 get with the API.

Shane